CVE-2024-26924

What it actually does

Use-after-free in nft_set_pipapo remove logic when duplicate keys exist across generations due to timeouts; removal can deactivate the wrong element, leaving a stale pointer reachable during later lookups and causing KASAN-detected crashes.

Why it matters to the business

Affected Linux systems may experience kernel panics or service disruption during routine netfilter set operations with short-lived elements, increasing operational overhead for patching and potentially affecting network availability on high-volume systems.

How an attack unfolds

An attacker with the ability to issue repeated nft add and delete element commands against a pipapo set can trigger the key-collision path in nft_pipapo_remove, causing the wrong element to remain active while a freed one is still referenced, resulting in a crash on subsequent lookup.

How to fix it

Upgrade the Linux kernel to the commit e3b887a9c11caf8357a821260e095f2a694a34f2 or later stable releases that contain the fix; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit e3b887a9c11caf8357a821260e095f2a694a34f2; reproduce the original add/remove pattern with KASAN enabled and verify absence of splats.

Typical attack path

1. Obtain ability to load or influence netfilter rules on a vulnerable kernel
2. Create a pipapo set and insert multiple elements sharing keys with short timeouts
3. Issue rapid add/remove sequences that hit the duplicate-key removal path
4. Trigger lookup or batch processing that dereferences the stale pointer

How to detect it

Inspect kernel logs and KASAN reports for splats originating in nft_pipapo_remove or nft_set_pipapo during element removal; correlate with netfilter batch operations.

What your security team should do

• Prioritize kernel updates on systems exposing netfilter to untrusted users
• Enable KASAN or similar debugging on test systems to validate the patch
• Monitor kernel logs for nft_pipapo related crashes as a temporary detection measure